main.d1bkmsmxgumaod.amplifyapp.com Open in urlscan Pro
13.33.174.34  Malicious Activity! Public Scan

Submitted URL: https://main.d1bkmsmxgumaod.amplifyapp.com/?bcda=%280101%29-50995-72334
Effective URL: https://main.d1bkmsmxgumaod.amplifyapp.com/werrx01USAHTML/?bcda=(0101)-50995-72334
Submission: On January 29 via api from JP — Scanned from JP

Summary

This website contacted 4 IPs in 2 countries across 4 domains to perform 20 HTTP transactions. The main IP is 13.33.174.34, located in United States and belongs to AMAZON-02, US. The main domain is main.d1bkmsmxgumaod.amplifyapp.com.
TLS certificate: Issued by Amazon RSA 2048 M03 on January 29th 2024. Valid for: a year.
This is the only time main.d1bkmsmxgumaod.amplifyapp.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Tech Support Scam (Consumer)

Domain & IP information

IP Address AS Autonomous System
16 13.33.174.34 16509 (AMAZON-02)
1 2404:6800:400... 15169 (GOOGLE)
2 2404:6800:400... 15169 (GOOGLE)
1 172.67.208.186 13335 (CLOUDFLAR...)
20 4
Apex Domain
Subdomains
Transfer
16 amplifyapp.com
main.d1bkmsmxgumaod.amplifyapp.com
182 KB
2 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 27
21 KB
1 userstatics.com
userstatics.com — Cisco Umbrella Rank: 318745
719 B
1 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 37
64 KB
20 4
Domain Requested by
16 main.d1bkmsmxgumaod.amplifyapp.com main.d1bkmsmxgumaod.amplifyapp.com
2 www.google-analytics.com www.googletagmanager.com
www.google-analytics.com
1 userstatics.com main.d1bkmsmxgumaod.amplifyapp.com
1 www.googletagmanager.com main.d1bkmsmxgumaod.amplifyapp.com
20 4

This site contains no links.

Subject Issuer Validity Valid
*.d1bkmsmxgumaod.amplifyapp.com
Amazon RSA 2048 M03
2024-01-29 -
2025-02-26
a year crt.sh
*.google-analytics.com
GTS CA 1C3
2024-01-02 -
2024-03-26
3 months crt.sh
userstatics.com
E1
2024-01-29 -
2024-04-28
3 months crt.sh

This page contains 1 frames:

Primary Page: https://main.d1bkmsmxgumaod.amplifyapp.com/werrx01USAHTML/?bcda=(0101)-50995-72334
Frame ID: 41E3520A117FD9022652A3C0604050E0
Requests: 20 HTTP requests in this frame

Screenshot

Page Title

セキュリティにはアクションが必要です

Page URL History Show full URLs

  1. https://main.d1bkmsmxgumaod.amplifyapp.com/?bcda=%280101%29-50995-72334 Page URL
  2. https://main.d1bkmsmxgumaod.amplifyapp.com/werrx01USAHTML/?bcda=(0101)-50995-72334 Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js

Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtag/js

Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

20
Requests

100 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

268 kB
Transfer

828 kB
Size

4
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://main.d1bkmsmxgumaod.amplifyapp.com/?bcda=%280101%29-50995-72334 Page URL
  2. https://main.d1bkmsmxgumaod.amplifyapp.com/werrx01USAHTML/?bcda=(0101)-50995-72334 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

20 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
/
main.d1bkmsmxgumaod.amplifyapp.com/
1 KB
939 B
Document
General
Full URL
https://main.d1bkmsmxgumaod.amplifyapp.com/?bcda=%280101%29-50995-72334
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.33.174.34 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-33-174-34.nrt57.r.cloudfront.net
Software
AmazonS3 /
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language
jp-JP,jp;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
public, max-age=0, s-maxage=2
content-encoding
gzip
content-type
text/html
date
Mon, 29 Jan 2024 16:34:17 GMT
etag
W/"d965a5752493b39cb31d6d0d11d35b40"
last-modified
Mon, 29 Jan 2024 13:43:07 GMT
server
AmazonS3
vary
Accept-Encoding
via
1.1 bcaa73dd9eb58937e5bb422fc78109e0.cloudfront.net (CloudFront)
x-amz-cf-id
L7YcAdNp5ZGQk_8Qaa8Gk9JyrR9X_mz8E-XKJPUP6CmqOnBAMS8JJg==
x-amz-cf-pop
NRT57-C2
x-cache
Miss from cloudfront
Primary Request /
main.d1bkmsmxgumaod.amplifyapp.com/werrx01USAHTML/
20 KB
7 KB
Document
General
Full URL
https://main.d1bkmsmxgumaod.amplifyapp.com/werrx01USAHTML/?bcda=(0101)-50995-72334
Requested by
Host: main.d1bkmsmxgumaod.amplifyapp.com
URL: https://main.d1bkmsmxgumaod.amplifyapp.com/?bcda=%280101%29-50995-72334
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.33.174.34 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-33-174-34.nrt57.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
5f8c26c133e1ba0a386008ce20d6b404083ec5b4823882e1abc344a77bd729b5

Request headers

Referer
https://main.d1bkmsmxgumaod.amplifyapp.com/?bcda=%280101%29-50995-72334
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language
jp-JP,jp;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
public, max-age=0, s-maxage=2
content-encoding
gzip
content-type
text/html
date
Mon, 29 Jan 2024 16:34:18 GMT
etag
W/"a475294f4c2c10179a2599fc9373e69d"
last-modified
Mon, 29 Jan 2024 13:43:07 GMT
server
AmazonS3
vary
Accept-Encoding
via
1.1 bcaa73dd9eb58937e5bb422fc78109e0.cloudfront.net (CloudFront)
x-amz-cf-id
qLU0OyLYdbFqeU4TT31jZO-Og7zlJ7V_Pe69hlqNQH8dpwoIjz2vBA==
x-amz-cf-pop
NRT57-C2
x-cache
Miss from cloudfront
pstyle.css
main.d1bkmsmxgumaod.amplifyapp.com/werrx01USAHTML/css/
32 KB
7 KB
Stylesheet
General
Full URL
https://main.d1bkmsmxgumaod.amplifyapp.com/werrx01USAHTML/css/pstyle.css
Requested by
Host: main.d1bkmsmxgumaod.amplifyapp.com
URL: https://main.d1bkmsmxgumaod.amplifyapp.com/werrx01USAHTML/?bcda=(0101)-50995-72334
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
13.33.174.34 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-33-174-34.nrt57.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
e17862e4b3afc86e60f904cde105bc0cc57a60096bcda198e821123ddc442bf5

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://main.d1bkmsmxgumaod.amplifyapp.com/werrx01USAHTML/?bcda=(0101)-50995-72334
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Mon, 29 Jan 2024 16:34:18 GMT
content-encoding
gzip
via
1.1 aa19ac2dc7aac8963b7348f7816ca144.cloudfront.net (CloudFront)
last-modified
Mon, 29 Jan 2024 13:43:07 GMT
server
AmazonS3
x-amz-cf-pop
NRT57-C2
etag
W/"38dfff8f0797e7c7c106e63b88f167f1"
vary
Accept-Encoding
x-cache
Miss from cloudfront
content-type
text/css
cache-control
public, max-age=0, s-maxage=2
alt-svc
h3=":443"; ma=86400
x-amz-cf-id
rkDnptZRhZYsznkxi6HFg3OQgpEX2qetyfzhEk5bG8RpIeS72M-gsA==
js
www.googletagmanager.com/gtag/
176 KB
64 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=UA-xxx-x
Requested by
Host: main.d1bkmsmxgumaod.amplifyapp.com
URL: https://main.d1bkmsmxgumaod.amplifyapp.com/werrx01USAHTML/?bcda=(0101)-50995-72334
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2404:6800:4004:824::2008 , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
ee093328da4d25e74ee711c84ac35c00797f4463c158c394b977fe9a6dffa03f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://main.d1bkmsmxgumaod.amplifyapp.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Mon, 29 Jan 2024 16:34:18 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
65418
x-xss-protection
0
last-modified
Mon, 29 Jan 2024 15:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Mon, 29 Jan 2024 16:34:18 GMT
msmm.png
main.d1bkmsmxgumaod.amplifyapp.com/werrx01USAHTML/
168 B
464 B
Image
General
Full URL
https://main.d1bkmsmxgumaod.amplifyapp.com/werrx01USAHTML/msmm.png
Requested by
Host: main.d1bkmsmxgumaod.amplifyapp.com
URL: https://main.d1bkmsmxgumaod.amplifyapp.com/werrx01USAHTML/?bcda=(0101)-50995-72334
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
13.33.174.34 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-33-174-34.nrt57.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
1ab5ef4e7e196cb1ff39df44e1a0a39f6880b906ef6fd6da3cfdbb92ffd33115

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://main.d1bkmsmxgumaod.amplifyapp.com/werrx01USAHTML/?bcda=(0101)-50995-72334
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Mon, 29 Jan 2024 16:34:18 GMT
via
1.1 aa19ac2dc7aac8963b7348f7816ca144.cloudfront.net (CloudFront)
last-modified
Mon, 29 Jan 2024 13:43:07 GMT
server
AmazonS3
x-amz-cf-pop
NRT57-C2
etag
"acb05ebcd5f488fc99169cff02b6dd04"
x-cache
Miss from cloudfront
content-type
image/png
cache-control
public, max-age=0, s-maxage=2
accept-ranges
bytes
alt-svc
h3=":443"; ma=86400
content-length
168
x-amz-cf-id
0xvCDKfXUE_PLvYHFuyuRrNu15pUmlUMSk6q22PUDJvTnRA5Gu1sKQ==
dm.png
main.d1bkmsmxgumaod.amplifyapp.com/werrx01USAHTML/
332 B
626 B
Image
General
Full URL
https://main.d1bkmsmxgumaod.amplifyapp.com/werrx01USAHTML/dm.png
Requested by
Host: main.d1bkmsmxgumaod.amplifyapp.com
URL: https://main.d1bkmsmxgumaod.amplifyapp.com/werrx01USAHTML/?bcda=(0101)-50995-72334
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
13.33.174.34 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-33-174-34.nrt57.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
7df9f467d23ee1887edb2123cca10a1a9c4624cdcf7199c64e78a8430031f9f5

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://main.d1bkmsmxgumaod.amplifyapp.com/werrx01USAHTML/?bcda=(0101)-50995-72334
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Mon, 29 Jan 2024 16:34:18 GMT
via
1.1 aa19ac2dc7aac8963b7348f7816ca144.cloudfront.net (CloudFront)
last-modified
Mon, 29 Jan 2024 13:43:07 GMT
server
AmazonS3
x-amz-cf-pop
NRT57-C2
etag
"9d8a90a63d20f05d27e5d6abb35e0cd0"
x-cache
Miss from cloudfront
content-type
image/png
cache-control
public, max-age=0, s-maxage=2
accept-ranges
bytes
alt-svc
h3=":443"; ma=86400
content-length
332
x-amz-cf-id
KpCkWoztKT5Rqacsld4wE9YhJ74aKwz2jUONJlLgBAOLygX8BlsLdQ==
cs.png
main.d1bkmsmxgumaod.amplifyapp.com/werrx01USAHTML/
3 KB
3 KB
Image
General
Full URL
https://main.d1bkmsmxgumaod.amplifyapp.com/werrx01USAHTML/cs.png
Requested by
Host: main.d1bkmsmxgumaod.amplifyapp.com
URL: https://main.d1bkmsmxgumaod.amplifyapp.com/werrx01USAHTML/?bcda=(0101)-50995-72334
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
13.33.174.34 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-33-174-34.nrt57.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
b67a7c07a045d7cb0f2e216a557aec0d99405e17c36d1a6b1ff3e2733aa35348

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://main.d1bkmsmxgumaod.amplifyapp.com/werrx01USAHTML/?bcda=(0101)-50995-72334
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Mon, 29 Jan 2024 16:34:19 GMT
via
1.1 aa19ac2dc7aac8963b7348f7816ca144.cloudfront.net (CloudFront)
last-modified
Mon, 29 Jan 2024 13:43:07 GMT
server
AmazonS3
x-amz-cf-pop
NRT57-C2
etag
"b01a30d354bfcf51edf33e0b0ea07402"
x-cache
Miss from cloudfront
content-type
image/png
cache-control
public, max-age=0, s-maxage=2
accept-ranges
bytes
alt-svc
h3=":443"; ma=86400
content-length
2681
x-amz-cf-id
vS72m_VglIlcTX2xkktPp7bK0vlPl3pI-7Y5BhEXBbD0SIkSAXI1HA==
re.gif
main.d1bkmsmxgumaod.amplifyapp.com/werrx01USAHTML/
14 KB
15 KB
Image
General
Full URL
https://main.d1bkmsmxgumaod.amplifyapp.com/werrx01USAHTML/re.gif
Requested by
Host: main.d1bkmsmxgumaod.amplifyapp.com
URL: https://main.d1bkmsmxgumaod.amplifyapp.com/werrx01USAHTML/?bcda=(0101)-50995-72334
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
13.33.174.34 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-33-174-34.nrt57.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
4b436b0b6a47db85c88f83dc3fe3fd9a96c0a4018b28832165df929dffe0bc86

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://main.d1bkmsmxgumaod.amplifyapp.com/werrx01USAHTML/?bcda=(0101)-50995-72334
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Mon, 29 Jan 2024 16:34:19 GMT
via
1.1 aa19ac2dc7aac8963b7348f7816ca144.cloudfront.net (CloudFront)
last-modified
Mon, 29 Jan 2024 13:43:07 GMT
server
AmazonS3
x-amz-cf-pop
NRT57-C2
etag
"6fcb78e0cd7933a70eea2cf071f82118"
x-cache
Miss from cloudfront
content-type
image/gif
cache-control
public, max-age=0, s-maxage=2
accept-ranges
bytes
alt-svc
h3=":443"; ma=86400
content-length
14751
x-amz-cf-id
kf0KeD6HRrLvuMC5vP6_TuBGmMDWjjwnn0_bq3oQwN9Wddl5uOi4mw==
wall.png
main.d1bkmsmxgumaod.amplifyapp.com/werrx01USAHTML/images/
1 KB
1 KB
Image
General
Full URL
https://main.d1bkmsmxgumaod.amplifyapp.com/werrx01USAHTML/images/wall.png
Requested by
Host: main.d1bkmsmxgumaod.amplifyapp.com
URL: https://main.d1bkmsmxgumaod.amplifyapp.com/werrx01USAHTML/?bcda=(0101)-50995-72334
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
13.33.174.34 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-33-174-34.nrt57.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
ee4bc5fe81fa7c1e8497d79c9c8a96485df217092d334e9b48fa8840fed11d03

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://main.d1bkmsmxgumaod.amplifyapp.com/werrx01USAHTML/?bcda=(0101)-50995-72334
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Mon, 29 Jan 2024 16:34:19 GMT
via
1.1 aa19ac2dc7aac8963b7348f7816ca144.cloudfront.net (CloudFront)
last-modified
Mon, 29 Jan 2024 13:43:07 GMT
server
AmazonS3
x-amz-cf-pop
NRT57-C2
etag
"bf2b460590fbb9d8e9611a6e9006b816"
x-cache
Miss from cloudfront
content-type
image/png
cache-control
public, max-age=0, s-maxage=2
accept-ranges
bytes
alt-svc
h3=":443"; ma=86400
content-length
1045
x-amz-cf-id
c_rWHFjQpQlYrRZBLOeyvpyJhcPtN78ZkWqvRqxrZDjlJ4zz-H82Ew==
pscript.js
main.d1bkmsmxgumaod.amplifyapp.com/werrx01USAHTML/js/
9 KB
3 KB
Script
General
Full URL
https://main.d1bkmsmxgumaod.amplifyapp.com/werrx01USAHTML/js/pscript.js
Requested by
Host: main.d1bkmsmxgumaod.amplifyapp.com
URL: https://main.d1bkmsmxgumaod.amplifyapp.com/werrx01USAHTML/?bcda=(0101)-50995-72334
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
13.33.174.34 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-33-174-34.nrt57.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
4ef01e4af70d28c3a12c54ed17c9ca0b8d1a5b39b42dde46ce7206000f947edf

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://main.d1bkmsmxgumaod.amplifyapp.com/werrx01USAHTML/?bcda=(0101)-50995-72334
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Mon, 29 Jan 2024 16:34:19 GMT
content-encoding
gzip
via
1.1 aa19ac2dc7aac8963b7348f7816ca144.cloudfront.net (CloudFront)
last-modified
Mon, 29 Jan 2024 13:43:07 GMT
server
AmazonS3
x-amz-cf-pop
NRT57-C2
etag
W/"e9f0c63dae7a69ef0ffea6badaf47dcb"
vary
Accept-Encoding
x-cache
Miss from cloudfront
content-type
application/javascript
cache-control
public, max-age=0, s-maxage=2
alt-svc
h3=":443"; ma=86400
x-amz-cf-id
JybYgfaIyYhSAjAWDVdiBuhJ9IagNLRsDSV4iRHnrURJHBNqLF6Xpw==
jquery-3.2.1.min.js
main.d1bkmsmxgumaod.amplifyapp.com/werrx01USAHTML/js/
85 KB
30 KB
Script
General
Full URL
https://main.d1bkmsmxgumaod.amplifyapp.com/werrx01USAHTML/js/jquery-3.2.1.min.js
Requested by
Host: main.d1bkmsmxgumaod.amplifyapp.com
URL: https://main.d1bkmsmxgumaod.amplifyapp.com/werrx01USAHTML/?bcda=(0101)-50995-72334
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
13.33.174.34 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-33-174-34.nrt57.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
ba7d154e5ef77906946f6ae267c919a96df47cf7abbb1f7f4fb36a434493ee65

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://main.d1bkmsmxgumaod.amplifyapp.com/werrx01USAHTML/?bcda=(0101)-50995-72334
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Mon, 29 Jan 2024 16:34:19 GMT
content-encoding
gzip
via
1.1 aa19ac2dc7aac8963b7348f7816ca144.cloudfront.net (CloudFront)
last-modified
Mon, 29 Jan 2024 13:43:07 GMT
server
AmazonS3
x-amz-cf-pop
NRT57-C2
etag
W/"0f62753e9462c9b2b7b2260e0f22f866"
vary
Accept-Encoding
x-cache
Miss from cloudfront
content-type
application/javascript
cache-control
public, max-age=0, s-maxage=2
alt-svc
h3=":443"; ma=86400
x-amz-cf-id
ugPk-Xc-i27AchlfheGVSqeZRVeFy3mnYE47-xigL_8WucMiiEZfzw==
5f205bb74a5eb_v.css
main.d1bkmsmxgumaod.amplifyapp.com/werrx01USAHTML/css/
215 B
509 B
Stylesheet
General
Full URL
https://main.d1bkmsmxgumaod.amplifyapp.com/werrx01USAHTML/css/5f205bb74a5eb_v.css
Requested by
Host: main.d1bkmsmxgumaod.amplifyapp.com
URL: https://main.d1bkmsmxgumaod.amplifyapp.com/werrx01USAHTML/?bcda=(0101)-50995-72334
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
13.33.174.34 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-33-174-34.nrt57.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
bde6a5369760d9427c6d72a624f3087740cfbe00cb421f381cff78733d0fe52e

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://main.d1bkmsmxgumaod.amplifyapp.com/werrx01USAHTML/?bcda=(0101)-50995-72334
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Mon, 29 Jan 2024 16:34:19 GMT
via
1.1 aa19ac2dc7aac8963b7348f7816ca144.cloudfront.net (CloudFront)
last-modified
Mon, 29 Jan 2024 13:43:07 GMT
server
AmazonS3
x-amz-cf-pop
NRT57-C2
etag
"8d09a7c2d5bbfbc6eb22fbc87d94f1e5"
x-cache
Miss from cloudfront
content-type
text/css
cache-control
public, max-age=0, s-maxage=2
accept-ranges
bytes
alt-svc
h3=":443"; ma=86400
content-length
215
x-amz-cf-id
DEWyDUKuSf5of4jVysNiKoNOSqggko7PuZ7eEay36TqsldiFXlRaHA==
froala_style.min.css
main.d1bkmsmxgumaod.amplifyapp.com/werrx01USAHTML/css/
7 KB
2 KB
Stylesheet
General
Full URL
https://main.d1bkmsmxgumaod.amplifyapp.com/werrx01USAHTML/css/froala_style.min.css
Requested by
Host: main.d1bkmsmxgumaod.amplifyapp.com
URL: https://main.d1bkmsmxgumaod.amplifyapp.com/werrx01USAHTML/?bcda=(0101)-50995-72334
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
13.33.174.34 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-33-174-34.nrt57.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
1cfc73a6db9523c12b6b7f5d009bed19c8799eed001f607bd891a1fd838b7739

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://main.d1bkmsmxgumaod.amplifyapp.com/werrx01USAHTML/?bcda=(0101)-50995-72334
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Mon, 29 Jan 2024 16:34:19 GMT
content-encoding
gzip
via
1.1 aa19ac2dc7aac8963b7348f7816ca144.cloudfront.net (CloudFront)
last-modified
Mon, 29 Jan 2024 13:43:07 GMT
server
AmazonS3
x-amz-cf-pop
NRT57-C2
etag
W/"8d4fba5186f02a0c4458986b0cf91667"
vary
Accept-Encoding
x-cache
Miss from cloudfront
content-type
text/css
cache-control
public, max-age=0, s-maxage=2
alt-svc
h3=":443"; ma=86400
x-amz-cf-id
VELx_-C93-viDkodbk7dKznDphcEx0l-u7BSJmViqm_2ggdJrwQ2ig==
5f205bb63ccd2_v.css
main.d1bkmsmxgumaod.amplifyapp.com/werrx01USAHTML/css/
215 B
508 B
Stylesheet
General
Full URL
https://main.d1bkmsmxgumaod.amplifyapp.com/werrx01USAHTML/css/5f205bb63ccd2_v.css
Requested by
Host: main.d1bkmsmxgumaod.amplifyapp.com
URL: https://main.d1bkmsmxgumaod.amplifyapp.com/werrx01USAHTML/?bcda=(0101)-50995-72334
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
13.33.174.34 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-33-174-34.nrt57.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
b2e3bab239ceeccef12af09a16dad170ced312a26e918b8b6ee808e150dc598f

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://main.d1bkmsmxgumaod.amplifyapp.com/werrx01USAHTML/?bcda=(0101)-50995-72334
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Mon, 29 Jan 2024 16:34:19 GMT
via
1.1 aa19ac2dc7aac8963b7348f7816ca144.cloudfront.net (CloudFront)
last-modified
Mon, 29 Jan 2024 13:43:07 GMT
server
AmazonS3
x-amz-cf-pop
NRT57-C2
etag
"6404d14881bace88f82a98ca0661a5f4"
x-cache
Miss from cloudfront
content-type
text/css
cache-control
public, max-age=0, s-maxage=2
accept-ranges
bytes
alt-svc
h3=":443"; ma=86400
content-length
215
x-amz-cf-id
6Jp4nNqNlJdqKlMydbAP3E6UpMcwWpQ4gklOctxeEfikgSJheZM7mw==
5f205bc497791_v.css
main.d1bkmsmxgumaod.amplifyapp.com/werrx01USAHTML/css/
215 B
509 B
Stylesheet
General
Full URL
https://main.d1bkmsmxgumaod.amplifyapp.com/werrx01USAHTML/css/5f205bc497791_v.css
Requested by
Host: main.d1bkmsmxgumaod.amplifyapp.com
URL: https://main.d1bkmsmxgumaod.amplifyapp.com/werrx01USAHTML/?bcda=(0101)-50995-72334
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
13.33.174.34 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-33-174-34.nrt57.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
eeea3053ace1602a6f2582bcccb90fac1191ecce1c49a0370bef53299a7b44a6

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://main.d1bkmsmxgumaod.amplifyapp.com/werrx01USAHTML/?bcda=(0101)-50995-72334
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Mon, 29 Jan 2024 16:34:19 GMT
via
1.1 aa19ac2dc7aac8963b7348f7816ca144.cloudfront.net (CloudFront)
last-modified
Mon, 29 Jan 2024 13:43:07 GMT
server
AmazonS3
x-amz-cf-pop
NRT57-C2
etag
"54adb5388fee62773142b044262b0c9b"
x-cache
Miss from cloudfront
content-type
text/css
cache-control
public, max-age=0, s-maxage=2
accept-ranges
bytes
alt-svc
h3=":443"; ma=86400
content-length
215
x-amz-cf-id
mIytgPf0I0gxrVb2Y6YTADFslOnpBrW4GAUkbd0xMxxI9kxbSJSNNg==
analytics.js
www.google-analytics.com/
52 KB
21 KB
Script
General
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-xxx-x
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2404:6800:4004:824::200e , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://main.d1bkmsmxgumaod.amplifyapp.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
date
Mon, 29 Jan 2024 14:42:47 GMT
last-modified
Tue, 12 Dec 2023 18:09:08 GMT
server
Golfe2
age
6692
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
20994
expires
Mon, 29 Jan 2024 16:42:47 GMT
website2.png
main.d1bkmsmxgumaod.amplifyapp.com/werrx01USAHTML/images/
111 KB
111 KB
Image
General
Full URL
https://main.d1bkmsmxgumaod.amplifyapp.com/werrx01USAHTML/images/website2.png
Requested by
Host: main.d1bkmsmxgumaod.amplifyapp.com
URL: https://main.d1bkmsmxgumaod.amplifyapp.com/werrx01USAHTML/?bcda=(0101)-50995-72334
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
13.33.174.34 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-33-174-34.nrt57.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
948b1331677d0f9991d50376bfba436033c5a9cc5919cf9f74c03424b6f3e342

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://main.d1bkmsmxgumaod.amplifyapp.com/werrx01USAHTML/?bcda=(0101)-50995-72334
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Mon, 29 Jan 2024 16:34:19 GMT
via
1.1 aa19ac2dc7aac8963b7348f7816ca144.cloudfront.net (CloudFront)
last-modified
Mon, 29 Jan 2024 13:43:07 GMT
server
AmazonS3
x-amz-cf-pop
NRT57-C2
etag
"5e20d8c5bd6c7a06298a2663a1cc8403"
x-cache
Miss from cloudfront
content-type
image/png
cache-control
public, max-age=0, s-maxage=2
accept-ranges
bytes
alt-svc
h3=":443"; ma=86400
content-length
113635
x-amz-cf-id
DIbOdNOvenxfKkSNBXqTLuuuz_3QeAuR96t0EXj3cYxUIgyrBm9krw==
collect
www.google-analytics.com/j/
1 B
220 B
XHR
General
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j101&a=178402805&t=pageview&_s=1&dl=https%3A%2F%2Fmain.d1bkmsmxgumaod.amplifyapp.com%2Fwerrx01USAHTML%2F%3Fbcda%3D(0101)-50995-72334&ul=en-us&de=UTF-8&dt=%E3%82%BB%E3%82%AD%E3%83%A5%E3%83%AA%E3%83%86%E3%82%A3%E3%81%AB%E3%81%AF%E3%82%A2%E3%82%AF%E3%82%B7%E3%83%A7%E3%83%B3%E3%81%8C%E5%BF%85%E8%A6%81%E3%81%A7%E3%81%99&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAUABAAAAACAAI~&jid=1986178738&gjid=859729824&cid=1436280924.1706546059&tid=UA-xxx-x&_gid=630130889.1706546059&_r=1&gtm=457e41o0&gcd=11l1l1l1l1&dma=0&jsscut=1&z=1706100805
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2404:6800:4004:824::200e , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://main.d1bkmsmxgumaod.amplifyapp.com/
accept-language
jp-JP,jp;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Mon, 29 Jan 2024 16:34:19 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://main.d1bkmsmxgumaod.amplifyapp.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1
expires
Fri, 01 Jan 1990 00:00:00 GMT
audio1.wav
main.d1bkmsmxgumaod.amplifyapp.com/werrx01USAHTML/media/
315 KB
0
Media
General
Full URL
https://main.d1bkmsmxgumaod.amplifyapp.com/werrx01USAHTML/media/audio1.wav
Requested by
Host: main.d1bkmsmxgumaod.amplifyapp.com
URL: https://main.d1bkmsmxgumaod.amplifyapp.com/werrx01USAHTML/?bcda=(0101)-50995-72334
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
13.33.174.34 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-33-174-34.nrt57.r.cloudfront.net
Software
AmazonS3 /
Resource Hash

Request headers

Referer
https://main.d1bkmsmxgumaod.amplifyapp.com/werrx01USAHTML/?bcda=(0101)-50995-72334
Accept-Encoding
identity;q=1, *;q=0
accept-language
jp-JP,jp;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Range
bytes=0-

Response headers

date
Mon, 29 Jan 2024 16:34:20 GMT
via
1.1 aa19ac2dc7aac8963b7348f7816ca144.cloudfront.net (CloudFront)
last-modified
Mon, 29 Jan 2024 13:43:07 GMT
server
AmazonS3
x-amz-cf-pop
NRT57-C2
etag
"bc750f522d327ce9eb63b695fde55114"
x-cache
Miss from cloudfront
content-type
audio/wave
Content-Range
bytes 0-1701581/1701582
cache-control
public, max-age=0, s-maxage=2
accept-ranges
bytes
alt-svc
h3=":443"; ma=86400
x-amz-cf-id
Ms-SZDic-IHaZpurYS4oA8luYo-E53HeyRfWXHTXwF6OnQZlXEOMcA==
Content-Length
1701582
script.js
userstatics.com/get/
133 B
719 B
Script
General
Full URL
https://userstatics.com/get/script.js?referrer=https://main.d1bkmsmxgumaod.amplifyapp.com/werrx01USAHTML/?bcda=(0101)-50995-72334
Requested by
Host: main.d1bkmsmxgumaod.amplifyapp.com
URL: https://main.d1bkmsmxgumaod.amplifyapp.com/werrx01USAHTML/js/jquery-3.2.1.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.208.186 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / PHP/8.2.1
Resource Hash
df9690fea031319de38a437cb6d393026c4aae70642ed394c4254ed64f035b26

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://main.d1bkmsmxgumaod.amplifyapp.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Mon, 29 Jan 2024 16:34:21 GMT
content-encoding
br
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
x-powered-by
PHP/8.2.1
vary
Accept-Encoding
access-control-allow-methods
GET, POST
content-type
text/html; charset=utf-8
access-control-allow-origin
https://main.d1bkmsmxgumaod.amplifyapp.com
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IjNuk8nBzLFG4wjoEudOwiPDA0u7hcVpABdJ2h8DjSXlr7WLeLSU1w%2Fn9uRiXV9rfdUAFV%2F0BFBJNLy3aGvurSUrWwKLfni8rXLYxIVicyQTZy59UOL5U0yzR%2BF%2Fk34%2F5QI%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-credentials
true
cf-ray
84d2e1cfde2c3420-NRT
access-control-allow-headers
X-Requested-With,content-type
alt-svc
h3=":443"; ma=86400

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Tech Support Scam (Consumer)

40 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| google_tag_manager object| google_tag_data object| dataLayer function| gtag string| GoogleAnalyticsObject function| ga function| getVariableFromURl string| bcda object| gaplugins object| gaGlobal object| gaData function| showBlueDescriptionPopupWithDelay function| showerrorTelecast function| closeFirstPopup function| changeBackground function| showDisclaimerPopup function| cancelFirstPopup function| okFirstPopup function| simulateF11Key function| showBlueDescriptionPopup function| showSecondPopup function| showSupportNotificationWithDelay function| hideSecondPopup function| showKeyCodePopup function| submitKeyCode function| closeSecondPopup function| getRandomSupportResponse function| handleSuggestion function| getSupportResponse object| modal object| btn object| span number| e number| isNS function| mischandler function| mousehandler function| $ function| jQuery function| myFunction function| addEvent

4 Cookies

Domain/Path Name / Value
main.d1bkmsmxgumaod.amplifyapp.com/werrx01USAHTML Name: PHPREFS
Value: full
.amplifyapp.com/ Name: _ga
Value: GA1.2.1436280924.1706546059
.amplifyapp.com/ Name: _gid
Value: GA1.2.630130889.1706546059
.amplifyapp.com/ Name: _gat_gtag_UA_xxx_x
Value: 1

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

main.d1bkmsmxgumaod.amplifyapp.com
userstatics.com
www.google-analytics.com
www.googletagmanager.com
13.33.174.34
172.67.208.186
2404:6800:4004:824::2008
2404:6800:4004:824::200e
1ab5ef4e7e196cb1ff39df44e1a0a39f6880b906ef6fd6da3cfdbb92ffd33115
1cfc73a6db9523c12b6b7f5d009bed19c8799eed001f607bd891a1fd838b7739
4b436b0b6a47db85c88f83dc3fe3fd9a96c0a4018b28832165df929dffe0bc86
4ef01e4af70d28c3a12c54ed17c9ca0b8d1a5b39b42dde46ce7206000f947edf
5f8c26c133e1ba0a386008ce20d6b404083ec5b4823882e1abc344a77bd729b5
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
7df9f467d23ee1887edb2123cca10a1a9c4624cdcf7199c64e78a8430031f9f5
948b1331677d0f9991d50376bfba436033c5a9cc5919cf9f74c03424b6f3e342
b2e3bab239ceeccef12af09a16dad170ced312a26e918b8b6ee808e150dc598f
b67a7c07a045d7cb0f2e216a557aec0d99405e17c36d1a6b1ff3e2733aa35348
ba7d154e5ef77906946f6ae267c919a96df47cf7abbb1f7f4fb36a434493ee65
bde6a5369760d9427c6d72a624f3087740cfbe00cb421f381cff78733d0fe52e
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
df9690fea031319de38a437cb6d393026c4aae70642ed394c4254ed64f035b26
e17862e4b3afc86e60f904cde105bc0cc57a60096bcda198e821123ddc442bf5
ee093328da4d25e74ee711c84ac35c00797f4463c158c394b977fe9a6dffa03f
ee4bc5fe81fa7c1e8497d79c9c8a96485df217092d334e9b48fa8840fed11d03
eeea3053ace1602a6f2582bcccb90fac1191ecce1c49a0370bef53299a7b44a6